What is the CVSS score of CVE-2026-44871?

CVE-2026-44871 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of HPE Aruba AOS are affected by CVE-2026-44871?

HPE Aruba Networking Wireless OS (AOS-8 and AOS-10) contains a command injection vulnerability in the PAPI-accessed CLI service that allows authenticated high-privilege users to execute arbitrary…

How to fix or mitigate CVE-2026-44871?

Within 24 hours, inventory all HPE Aruba Networking controllers and gateways running AOS-8 or AOS-10, and document which administrative users have PAPI CLI access and high-privilege credentials. Within 7 days, restrict PAPI CLI access to only administrators with documented business need, implement network segmentation to limit direct access to these devices from untrusted zones, and enable detailed logging of all PAPI CLI commands. Within 30 days, establish a monitoring process for HPE Aruba security advisories, enforce multi-factor authentication on all high-privilege administrative accounts, review and reduce administrative privilege scope across the wireless infrastructure, and re-assess PAPI CLI access requirements.

HPE Aruba AOS CVE-2026-44871

EUVD-2026-29849 HIGH

Command Injection (CWE-77)

2026-05-12 hpe

GHSA-hrpm-mj96-8vfp

Command Injection Hpe Aruba Networking Wireless Operating System Aos Hewlett Packard Enterprise Hpe

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

PAPI/CLI is network-reachable (AV:N) with low complexity, but the CLI service demands high-privilege admin authentication (PR:H); command injection to the OS yields total C/I/A impact within the same device (S:U).

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:19 vuln.today

CVE Published

May 12, 2026 - 21:06 nvd

HIGH 7.2

DescriptionCVE.org

Command injection vulnerabilities exist in the command line interface (CLI) service accessed by the PAPI protocol of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.

AnalysisAI

Command injection in the PAPI-accessed CLI service of HPE Aruba Networking Wireless OS (AOS-8 and AOS-10) allows an authenticated remote attacker to break out of the CLI and run arbitrary OS commands on the underlying controller or gateway. The flaw carries CVSS 7.2 (High) and full confidentiality/integrity/availability impact, but requires high privileges (PR:H). No public exploit identified at time of analysis, EPSS is low (0.07%), and CISA SSVC records no observed exploitation.

Technical ContextAI

AOS (ArubaOS) is the operating system running on HPE Aruba Networking wireless LAN controllers, mobility gateways, and instant access points. PAPI (Process Application Programming Interface) is Aruba's proprietary UDP-based control-plane protocol used for inter-process and inter-device management communication; here it fronts the device's command-line interface service. The root cause is CWE-77 (Improper Neutralization of Special Elements used in a Command), meaning CLI input reaching the PAPI service is passed to an underlying OS command interpreter without adequate sanitization, letting shell metacharacters or argument injection escape the intended CLI sandbox into the host OS. The affected CPE is cpe:2.3:a:hewlett_packard_enterprise_(hpe):hpe_aruba_networking_wireless_operating_system_(aos), spanning both the 8.x (AOS-8) and 10.x (AOS-10) branches.

RemediationAI

Patch available per vendor advisory: apply the fixed AOS builds referenced in HPE bulletin hpesbnw05048en_us (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US) - upgrade each affected train to the first fixed release above the vulnerable ranges (i.e., past 10.4.1.10, 10.7.2.2, 10.8.0.0, 8.10.0.21, 8.12.0.6, and 8.13.1.1; consult the bulletin for the exact patched version numbers, which are not independently confirmed here). Because exploitation requires an authenticated high-privilege management session, the most effective compensating control until patching is to restrict access to the management/PAPI plane: place controller and gateway management interfaces on a dedicated, firewalled management VLAN, block PAPI (UDP) and CLI/SSH access from user and untrusted networks, and permit management only from a hardened jump host or ACL-limited admin subnet (trade-off: tighter ACLs can disrupt existing NMS, AirWave/Central, or automation integrations that rely on that plane). Additionally enforce least-privilege admin roles and strong, unique management credentials with MFA to shrink the pool of accounts that can reach the vulnerable CLI, and audit management logins for anomalies.